Premium
How Westgate terrorists attack changed Kenya’s security laws
A police officer tries to secure an area inside the Westgate Mall in Nairobi during the terrorists attack of September 21, 2013.
What you need to know:
- Parliament passed sweeping legislation, allowing government agencies to listen to and record phone conversations without court permission.
- The terrorists who planned and executed the Westgate attack in 2013 exploited the lax procedures in obtaining mobile phone lines in Kenya.
The deadly terror attack on the Westgate Mall a decade ago changed many aspects of Kenyans’ lives.
The attack, which led to the deaths of 67 people, rattled Kenya and the entire region, prompting a re-evaluation of security in public spaces—the government began profiling and watching its own citizens, ushering in a new era of mass surveillance.
Parliament passed sweeping legislation, allowing government agencies to listen to and record phone conversations without court permission. Strict enforcement of SIM registration with punitive penalties for those in breach followed.
Safaricom was tapped to install and run a communication and surveillance system that is linked to police stations.
The attack also saw the country significantly increase spending on intelligence. Spending on the National Intelligence Service has more than tripled from Sh13.4 billion in the year ended June 2013 to Sh44.3 billion in the current one.
The huge budget has enhanced capacity for phone, email and internet surveillance. The increased eavesdropping is reckoned to have foiled more terror attack attempts.
The terrorists who planned and executed the Westgate attack in 2013 exploited the lax procedures in obtaining mobile phone lines in Kenya.
Investigators established that in preparation for the attack, eight Kenyan mobile numbers and a network of Somalia-linked numbers were used. These numbers were either associated with the “infantry attackers” who were inside Westgate from September 21 to 24, 2013 or part of the support/facilitation tier.
Rescued hostages are escorted by police to safety on September 21, 2013 at Westgate Mall in Nairobi which was under attack by terrorists.
A report by the UN Security Council Monitoring Group says that from the eight Kenyan numbers, seven were geolocated at the Westgate scene on September 21 through to September 23, 2013. Five of the numbers were apparently all activated and switched on within the deployment/attack phase between September 17 and 21 in Eastleigh. At least six of them were registered for M-Pesa with either actual or operational names.
On March 30, 2012, a known senior Al-Shabaab commander “Ibrahim” called a “Nairobi associate” asking for a security assessment of Nairobi. “Ibrahim” called again days later to request specific operational information on Westlands such as its size, population and level of security.
The Monitoring Group says another potential indicator of a possible Westgate Mall attack was the suspicious but equally circumstantial activity of “M”, a known Al-Shabaab-linked female logistician. Officials say the intelligence on the communication among the terror group’s associates was shared with Kenyan security agencies but they failed to act on it.
The report also indicates that the gang used Facebook to communicate.
For instance, on September 21, 2013, at 3.16 pm during the siege, a close associate of Abu Zinnirah, the Barawe-based Amir of Al-Hijra, and a Facebook associate to “M”, sent a message to “M” asking “Sis, u ok? Plz tell me no coffee 2day.”
On the second day of the siege, at 9.12am, “M” responded saying “Walkm slm, Alhamdulillah, had just left Westgate with my coffee and the shooting started. Alhamdulillah.”
Sources in government say the State has since also stepped up monitoring of social media accounts.
On September 21, 2013, a group of armed attackers pulled up at the main entrance of the Westgate Mall in a Mitsubishi Lancer and immediately began throwing grenades and shooting. Then they stormed into the main mall and indiscriminately shot shoppers. While in the mall, the gunmen kept communicating on phone using unregistered SIM cards with their associates in Somalia.
An image grab taken from AFP TV shows Kenyan troops taking position on September 21, 2013 inside the Westgate mall in Nairobi.
Today, telcos and their agents face stiff penalties for allowing unregistered SIM cards into their network or for selling pre-activated cards. Any person who knowingly provides false information during SIM card registration is liable to a fine not exceeding Sh100,000 or a jail term of not more than six months or both. Firms that breach the SIM registration rules face a financial penalty of up to 0.5 per cent of their annual gross turnover.
In Nairobi and other major metropolitan areas in East Africa, malls, supermarkets and hotels are typically protected by gates and staffed with security guards.
It is now a routine for cars that to be checked multiple times before entering buildings; security officers often run mirrors under vehicles to check for explosives before allowing them in.
At Jomo Kenyatta International Airport, passengers must exit their vehicles far from the entrance and pass through metal detectors on the side of the road while their vehicles are checked separately.
Thorough checks on people entering public spaces became the norm — hardly can a person enter a building without being scrutinised. Metal detectors that were few and far between are now a regular feature in buildings, as is the requirement for visitors to leave their details.
“Ten years down the line, lessons have been learnt. The areas that we were weak on, we have strengthened, and now we have built a collaborative framework of information sharing, of capacity building, of even responding in case of emergencies,” said Mr Fazul Mahamed, the director-general of the Private Security Regulatory Authority.
Motorists being subjected to security checks at the entrance of the Jomo Kenyatta International Airport in Nairobi.
According to National Counter Terrorism Centre director Rosalind Nyawira, another significant change after the Westgate attack is how security agencies communicate.
“Out of Westgate, a very good thing was born for Kenya, and that is agencies coming together, working together, no more silos,” she said. “So, we credit the aftermath of Westgate with the multi-agency spirit that we have today and that we are still advancing,” she added.
Generally better collaboration between security agencies was witnessed during the Dusit attack in Nairobi in January 2019 when security forces ended a similar siege more quickly and with fewer casualties.
Private Security Regulatory Authority Director-General, Fazul Mahamed during an interview in his office in Nairobi on September 18, 2023.
The attack also led to the enactment of the Security Laws (Amendment) Act 2014 and the establishment of a Multi-Agency Taskforce. But critics saw them as intrusive, especially particular clauses that allow government agencies to listen in to phone conversations and collect their data, such as where the calls were made.
On September 6, 2013, the Westgate attackers purchased the Mitsubishi Lancer from a garage in Nairobi. It was used to conduct surveillance, rehearse and identify potential secure routes to the mall from Eastleigh and eventually for the attack.
The undetected movement of the vehicle in part prompted the State to ink a deal with Safaricom for a security surveillance system backed by thousands of CCTV cameras. The contract involved installation of ultra-high definition CCTV cameras in Mombasa and Nairobi, connected to a command and control centre.
The national surveillance, communication and control system links all security agencies—military and police—electronically, making it easier to share information and direct operations.
The private sector has also upped the usage of CCTV cameras.
“For example, when you go to Westgate or another mall, it has what we call the facial recognition capability. So, as you walk, it will be able to pick your facial (features). And, mind you, we have a database of the criminals that the country is looking for. So, it will take that and scan it through that database,” said Mr Mahamed.
Private security guards in some key buildings also have gadgets that enable them to alert the police of any incident at the touch of a button.
Seven years later, on October 7, 2020, Mohammed Ahmed Abdi and Hussein Hassan Mustafa were found guilty of planning and committing acts of terror and helping a terrorist group. They were later sentenced to 33 and 18 years’ imprisonment.
Kenyan security personnel, crouched behind a ledge outside the Westgate Mall in Nairobi during the terrorist attack of September 23, 2013.
The third suspect, Liban Abdullahi, a Somali refugee, was acquitted of the charge of being in Kenya illegally and possessing identification documents by false pretences.
In the aftermath of the Westgate attack, Kenya suffered another heavy loss in April 2015 after Al Shabaab gunmen raided Garissa University, killing 144 people, mostly students.
But security agencies have since then foiled a number of other attack attempts, including a 2014 incident in Mombasa where a vehicle that had been procured and loaded with two TNT explosive cylinders was seized by the police.
The cylinders had been remotely connected to a triggering system and police also seized a cache of arms, including AK-47 rifles, 270 rounds of ammunition, six grenades, five magazines and four detonators.
